package flume;
import com.google.common.base.Charsets;
import com.google.common.collect.Lists;
import common.StringTransTools;
import org.apache.commons.lang.StringUtils;
import org.apache.flume.Context;
import org.apache.flume.Event;
import org.apache.flume.interceptor.Interceptor;

import java.text.SimpleDateFormat;
import java.util.List;
import java.util.Map;

/**
 * created by sonite on 2018/8/3
 */
public class AticInterceptor implements Interceptor {
    public void initialize() {

    }

    public Event intercept(Event event) {

        String body = new String(event.getBody(), Charsets.UTF_8);

        String tranBody=StringTransTools.parseString(body,":log_type"," ");
        //设置攻击的类型
        event.setBody(tranBody.getBytes());
        Map<String,String> headers=event.getHeaders();
        String logType="other";
        if(!StringUtils.isEmpty(tranBody)){
            logType=tranBody.substring(0,tranBody.indexOf("|"));
        }else{
            event.setBody(body.getBytes());
        }
        headers.put("logType",logType);
        return event;

    }

    public List<Event> intercept(List<Event> events) {
        List<Event> intercepted = Lists.newArrayListWithCapacity(events.size());
        for (Event event : events) {
            Event interceptedEvent = intercept(event);
            if (interceptedEvent != null) {
                intercepted.add(interceptedEvent);
            }
        }
        return intercepted;
    }

    public void close() {

    }



    public static class Builder implements Interceptor.Builder {
        //使用Builder初始化Interceptor
        @Override
        public Interceptor build() {
           return new AticInterceptor();
        }

        @Override
        public void configure(Context context) {

        }
    }


}
